Saturday, May 3, 2025
HomeCVE/vulnerabilityBeware Of Weaponized EBooks That Deliver AsyncRAT

Beware Of Weaponized EBooks That Deliver AsyncRAT

Published on

SIEM as a Service

Follow Us on Google News

EBooks are popular, and their popularity lucrative threat actors the most, as they are widely shared digital assets that can easily circumvent security measures. 

Threat actors exploit users’ trust in seemingly harmless documents by embedding malware in eBook files or disguising malicious code as legitimate eBooks.

ASEC researchers reported that AsyncRAT distribution is via multiple file extensions (.chm, .wsf, .lnk), with threat actors hiding the malware in apparently normal document files like questionnaires.

- Advertisement - Google News

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files

Weaponized EBooks Deliver AsyncRAT

Recently, a new tactic emerged where AsyncRAT is disguised as an eBook, demonstrating the evolving methods used to trick users into executing this remote access trojan.

Malicious eBook (Source – ASEC)

Within the weaponized eBook package, there is a fraudulent icon indicating an LNK file containing malicious code, another TXT file with a hidden PowerShell script, compressed video files, and an actual eBook.

A malicious LNK file (Source – ASEC)

Upon execution, it runs RM.TXT’s hidden PowerShell script through the LNK file, which then hides the downloader malware folder and performs an obfuscated script.

Based on security products found by this script, it can begin the real malware from fake video files.

Compressed files disguised as video files (Source – ASEC)

In total, three functions decompress the hidden files, register the task schedules, and execute the scripts. To run the AsyncRAT, these scripts gather the following data:-

  • System information
  • Load obfuscated files

The malware masquerades as legitimate processes to evade detection and uses various obfuscation techniques.

The AsyncRAT, the final payload, features anti-detection mechanisms, persistence, and data exfiltration capabilities. 

It’s distributed through various methods, including disguised files on sharing sites and phishing emails, making it a versatile and dangerous threat.

IoCs

MD5s:-

  • dea45ddf6c0ae0f9f3fde1bfd53bc34f (VideoVLC_subtitles.exe)
  • b8d16e9a76e9f77975a14bf4e03ac1ff (RM.TXT)
  • 50005f22608e93dff1d9ed18f6be95d3 (Business Secrets from the Bible – Rabbi Daniel Lapin.LNK)
  • 1ada2c6796a3486b79c5eb47fce9b19c (worldofprocure.rar)
  • 21714b248ab9ca42097a7834251a7452 (NTUSER.vbs{428f9636-1254-e23e3-ada2-03427pie22}.TM.vbs)

C&C Server:-

  • stevenhead.ddns[.]net

Download URL:-

  • hxxps://worldofprocure[.]com/worldofprocure.rar

“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Subscription-Based Scams Targeting Users to Steal Credit Card Information

Cybersecurity researchers at Bitdefender have identified a significant uptick in subscription-based scams, characterized by...

RansomHub Taps SocGholish: WebDAV & SCF Exploits Fuel Credential Heists

SocGholish, a notorious loader malware, has evolved into a critical tool for cybercriminals, often...

Hackers Weaponize Go Modules to Deliver Disk‑Wiping Malware, Causing Massive Data Loss

Cybersecurity researchers uncovered a sophisticated supply chain attack targeting the Go programming language ecosystem...

Hundreds of Fortune 500 Companies Have Unknowingly Employed North Korean IT Operatives

North Korean nationals have successfully infiltrated the employee ranks of major global corporations at...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Subscription-Based Scams Targeting Users to Steal Credit Card Information

Cybersecurity researchers at Bitdefender have identified a significant uptick in subscription-based scams, characterized by...

RansomHub Taps SocGholish: WebDAV & SCF Exploits Fuel Credential Heists

SocGholish, a notorious loader malware, has evolved into a critical tool for cybercriminals, often...

Hackers Weaponize Go Modules to Deliver Disk‑Wiping Malware, Causing Massive Data Loss

Cybersecurity researchers uncovered a sophisticated supply chain attack targeting the Go programming language ecosystem...